         issuer-pub   (utils/get-public-key issuer-keys)
         subject-keys (utils/generate-key-pair 512)
         subject-pub  (utils/get-public-key subject-keys)
-        subject-dn   (utils/cn "subject")]
+        subject      "subject"
+        subject-dn   (utils/cn subject)]
     (testing "basic extensions are created"
       (let [csr  (utils/generate-certificate-request subject-keys subject-dn)
             exts (create-agent-extensions csr issuer-pub)

    false
    (catch map? actual-map#
      (= actual-map# ~expected-map))))

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; Tests

        (is (= exts exts-expected))))

    (testing "only puppet extensions are extracted from CSR and DNS alt names is ignored."
      (let [csr-exts           [(utils/subject-dns-alt-names
                                  ["onefish"] false)
                                (utils/puppet-node-uid
                                  "AAAA-BBBB-CCCC-DDDD" false)]
            csr                (utils/generate-certificate-request
                                 subject-keys subject-dn csr-exts)
            csr-path           (path-to-cert-request csrdir subject)
            _                  (utils/obj->pem! csr csr-path)
            csr-fn             #(identity csr-path)
            expected-cert-path (path-to-cert signeddir subject)
            _                  (autosign-certificate-request!
                                 subject csr-fn (ca-test-settings))
            exts               (utils/get-extensions
                                 (utils/pem->cert expected-cert-path))]
        (is (not (contains-ext? exts "2.5.29.17")))
        (is (contains-ext? exts "1.3.6.1.4.1.34380.1.1.1"))
        (fs/delete expected-cert-path)
        (fs/delete csr-path)))))
